SQL Injection Vulnerability in Page and Post Clone Plugin for WordPress

CVE-2026-2893

What is CVE-2026-2893?

The Page and Post Clone plugin for WordPress suffers from a SQL Injection vulnerability through the 'meta_key' parameter within the content_clone() function. This issue arises due to inadequate escaping of user-supplied values and poor handling of SQL queries in versions up to 6.3. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious SQL commands. The attack allows for second-order injection where the payload is stored as a post meta key and executed upon cloning, enabling potential retrieval of sensitive database information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References